LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Regsvcs.exe

View source

Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies

ExecuteAWL Bypass
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1218.009

Loads the target .NET DLL file and executes the RegisterClass function.

COMMAND
regsvcs.exe {PATH:.dll}
USE CASE
Execute dll file and bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL (.NET)

AWL Bypass1

EXAMPLE 01T1218.009

Loads the target .NET DLL file and executes the RegisterClass function.

COMMAND
regsvcs.exe {PATH:.dll}
USE CASE
Execute dll file and bypass Application whitelisting
PRIVILEGES
Local Admin
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL (.NET)
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee